SB2017091422 - Input validation error in GNU Emacs

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2017091422

SB2017091422 - Input validation error in GNU Emacs

Published: September 14, 2017 Updated: August 4, 2020

Security Bulletin ID SB2017091422
Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Input validation error (CVE-ID: CVE-2017-14482)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with crafted "Content-Type: text/enriched" data containing an x-display XML element that specifies execution of shell commands, related to an unsafe text/enriched extension in lisp/textmodes/enriched.el, and unsafe Gnus support for enriched and richtext inline MIME objects in lisp/gnus/mm-view.el. In particular, an Emacs user can be instantly compromised by reading a crafted email message (or Usenet news article).


Remediation

Install update from vendor's website.

References